Ledger Confirms Supply-Chain Breach: Spy Chips in CryptoBilis Wallets Drained $102M

Key points

• Ledger confirmed on October 10 that at least one device sold by CryptoBilis contained an unauthorized hardware implant that drained user funds.
• Blockchain research firm Bitquery estimates that approximately $102 million in crypto was stolen from 315 accounts linked to compromised CryptoBilis devices.
• Researchers from Tibane Labs and Mark Karpelès identified three generations of the implant, with the most advanced version using a custom flexible circuit board and an eSIM for LTE transmission.
• Ledger advised users who purchased from CryptoBilis in the last 90 days to not set up their devices and to move assets to a new signer if already set up.
• A user in Germany reported finding implants in two Ledger Nano X devices purchased from MediaMarkt, suggesting the compromise may extend beyond CryptoBilis to other authorized resellers.
• Ledger stated that its security infrastructure and services were not compromised, but warned that its 'Genuine Check' mechanism cannot detect physical implants if the Secure Element remains intact.

Background

This incident follows earlier discoveries in 2026 by hardware hacker Joe Grand, who found similar implants in Ledger Nano X devices purchased from unauthorized sellers in Southeast Asia. Grand reported his findings to Ledger in March 2026, but the issue gained wider attention only after Mark Karpelès published his findings in September 2026. The current breach represents a significant escalation, as the implants are now being found in devices sold through authorized resellers, indicating a more sophisticated and widespread supply-chain attack.

How outlets are covering it

BleepingComputer and The Hacker News focus on Ledger's official confirmation of the implant and the immediate financial impact, citing $102 million in losses. Zero Day provides a broader perspective, highlighting the potential compromise of authorized resellers like MediaMarkt in Europe and the evolution of the implant technology from hand-soldered wires to custom flexible circuit boards. The Hacker News also notes Ledger's caution that its 'Genuine Check' cannot detect physical modifications, emphasizing the limitations of current security measures. All sources agree that the incident has severely damaged trust in Ledger's reseller network, with many users calling for its dismantling.

Why it matters

The breach of Ledger's hardware wallets, which are considered the gold standard for cryptocurrency security, has significant implications for the entire crypto industry. It demonstrates that even physical, air-gapped devices can be compromised through supply-chain attacks, undermining the trust users place in hardware wallets. The incident also highlights the growing sophistication of cybercriminals, who are now targeting authorized resellers to gain wider distribution for compromised devices. This could lead to increased scrutiny of supply-chain security and potentially stricter regulations for hardware wallet manufacturers and resellers.

What to watch

Ledger is continuing its investigation into the incident and is working with authorities to identify the perpetrators. The company has paused sales through CryptoBilis and other affected resellers, and is advising users to move their assets to new devices. It is unclear whether the compromise is limited to CryptoBilis or if other authorized resellers are also affected. The incident may lead to a broader review of Ledger's reseller network and potentially new security measures to prevent similar attacks in the future.